1

i work in electron js with aws cognito and oauth2. I need to get an accessToken dynamically from a Storage which is in a cloud endPoint in order to have the authorizations to get a list of data. As far as now, i can get the list if i specify the token in a static way. But i need it dynamic. The key for the token is CognitoIdentityServiceProvider.COGNITO_CLIENT_ID.username.accessToken But i can't seem to get it even if i configured Cognito

Here is my code for the configuration file which also contains the signIn function:

const  { Auth } = require('@aws-amplify/auth');
const { Amplify } = require('aws-amplify');
const AmazonCognitoIdentity = require('amazon-cognito-identity-js');
const CognitoUserPool = require('amazon-cognito-identity-js-node').CognitoUserPool;
const CognitoUserSession = require('amazon-cognito-identity-js-node').CognitoUserSession;
const CognitoUser = require('amazon-cognito-identity-js-node').CognitoUser;
const CognitoIdToken = require('amazon-cognito-identity-js-node').CognitoIdToken;
const CognitoAccessToken = require('@aws-amplify/auth');
const CognitoRefreshToken = require('amazon-cognito-identity-js-node').CognitoRefreshToken;
const COGNITO_USER_POOL_ID = 'eu-west-1_P0Jcr7nig';
const COGNITO_CLIENT_ID = '4m1utu56hjm835dshts9jg63ou';
const AWS_REGION = 'eu-west-1';

Amplify.configure({
 Auth: {
     // OPTIONAL - Enforce user authentication prior to accessing AWS resources or not
 mandatorySignIn: false,
  region: AWS_REGION,
  userPoolId: COGNITO_USER_POOL_ID,
   userPoolWebClientId: COGNITO_CLIENT_ID,
  // OPTIONAL - Manually set the authentication flow type. Default is 'USER_SRP_AUTH'
   authenticationFlowType: 'USER_PASSWORD_AUTH',

oauth: {
  domain: "https://edc-echosens-cloud.auth.eu-west-1.amazoncognito.com",
  scope: ["email", "profile", "openid"],
  redirectSignIn: "http://localhost:1962/",
  redirectSignOut: "http://localhost:1962/",
  responseType: "code", // or 'token', note that REFRESH token will only be generated when the responseType is code
},

API: {
  endpoints: [
    {
      name: 'PatientsList',
      endpoint: 'https://url',
    },
  ],
},
},
  });

 Auth.signIn({
  username: 'doctoredc@yopmail.com',
  password: 'kinG2804*D',
 }).then().catch(err => {
  console.log(err)});

  function getAccessToken() {
   const poolData = { 
     UserPoolId : COGNITO_USER_POOL_ID,
     ClientId : COGNITO_CLIENT_ID,
   };
   const userPool = new CognitoUserPool(poolData);
    var authenticationData = {
     Username : 'mymail@mail.com', // your username here
     Password : 'kinG2804*D', // your password here,
     authenticationFlowType: 'USER_PASSWORD_AUTH',
     Pool : userPool
       };
       var authenticationDetails = new AmazonCognitoIdentity.AuthenticationDetails(
         authenticationData);
       var cognitoUser = new CognitoUser(authenticationData);
       cognitoUser.authenticateUser(authenticationDetails, {
           onSuccess: function (result) {
             console.log('access token + ' + result.getAccessToken().getJwtToken());
           },
           onFailure: function(err) {
            console.log(err);
           },
        });
}


// You can get the current config object
//const currentConfig = Auth.configure();
exports.Auth = Auth;
 module.exports.getAccessToken = getAccessToken

I made the pool configurations, specified the api url, and the credentials. Also i added an Auth.signIn function and a getAccessToken function. Then this is the code to call the function in my main

 const API_URL = 'https://url';
  const headers = {
    "Content-Type": "application/json",
    Authorization: theAccessToken.getAccessToken()
    };
    console.log('Token Value:', theAccessToken.getAccessToken());
    const getPatients = async(API_URL) => {
      try {
        const response = await fetch(API_URL,{
          method: 'GET', headers: headers}
          );
        const json = await response.json();
        console.log(json);
      } catch (error) {
        console.log(error);
      }
      };
   getPatients(API_URL);

The problem is the team which made the cloud endpoint specified the authFlowType to be USER_PASSWORD_AUTH but i get an error message USER_SRP_AUTH is not enabled for the client. And they work with USER_PASSWORD_AUTH. So it's blocking me and i don't know what's wrong with not getting the access token dynamically.

Help me please i am so close to the answer .Thank you

Montasser
  • 77
  • 5

1 Answers1

0

When using OAuth your app should never see the password. To be dynamic, an Electron desktop app should perform logins via the system browser. Also you should use Authorization Code Flow (PKCE). These two things should enable the best security and usability.

HOW IT IS DONE

I have a couple of Electron samples that use Cognito which you can run quite easily. I am not using Amplify since I prefer open source security libraries:

Of course you may choose to do some things a little differently, but OAuth for Desktop apps is tricky and this may give you some ideas.

Gary Archer
  • 22,534
  • 2
  • 12
  • 24
  • thank you for the answer, i will see into it. It will help me understand COGNITO, even if for the time being i only needed to know a way to call CognitoIdentityServiceProvider.userpoolid.username.accessToken dynamically. But Thank you – Montasser Aug 05 '20 at 12:47